MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kinsing


Vendor detections: 10


Intelligence 10 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c
SHA3-384 hash: 3f2d8004af8700aec223d489b696d83595ff3df4d15751c3da2a325e9a4e86ce095acfdb51939d8272e1dc86165c1d73
SHA1 hash: 0ceb8ffb0be23b808b534d744440f4367e17b9c5
MD5 hash: b3039abf2ad5202f4a9363b418002351
humanhash: bakerloo-mountain-london-saturn
File name:kinsing
Download: download sample
Signature Kinsing
Create hunting rule
File size:5'967'872 bytes
First seen:2023-11-29 16:57:07 UTC
Last seen:2024-04-25 15:50:42 UTC
File type: elf
MIME type:application/x-executable
ssdeep 49152:wCe/ydXZSrb/TJvO90dL3BmAFd4A64nsfJvaWi9sglz/KbwLjFfiawr1eAOkzDIK:3eidO9suPF+NL4FiBnIrb3rE
TLSH T177564903F88955E9C3AED538CA659262BB70388A433023D32B60E7B51F76BD56F79350
telfhash t12e52787149bc78b5b6a6dd21f3a3b4b4953329b562f834b01023ac95efc1ec05cd686b
TrID 50.1% (.) ELF Executable and Linkable format (Linux) (4022/12)
49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)
Reporter Anonymous
Tags:elf Kinsing

Intelligence

File Origin
# of uploads :
3
# of downloads :
259
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.BackDoor.Kinsing.2.12292.31534.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
true
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
96
Number of processes launched:
8
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c
Behaviour
Anti-VM
Information Gathering
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0451aeb1-734d-442a-b1cc-c4d4efb2bd48
Result
Threat name:
Kinsing
Create hunting rule
Detection:
malicious
Classification:
mine
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1338561
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Kinsing Miner
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c/
Threat name:
Linux.Exploit.CVE-2023-32315
Create hunting rule
Status:
Malicious
First seen:
2023-08-08 07:30:45 UTC
File Type:
ELF64 Little (Exe)
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pb7czfhg3hhf5qa7ls7j5ysrqqy6zkcsgfkve3lnzbmtjsofpb6a._file
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:xmrig antivm evasion linux miner rootkit upx
Link:
https://tria.ge/reports/231129-vgtbysac72/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Checks hardware identifiers (DMI)
Enumerates running processes
Reads CPU attributes
Reads hardware information
Reads list of loaded kernel modules
Executes dropped EXE
Loads a kernel module
UPX packed file
XMRig Miner payload
xmrig
Malware family:
H2Miner
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/787e2c94e6d9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:crime_h2miner_kinsing
Create hunting rule
Author:Tony Lambert, Red Canary
Description:Rule to find Kinsing malware
Rule name:elf_kinsing_w0
Create hunting rule
Author:Tony Lambert, Red Canary
Description:Rule to find Kinsing malware
Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:enterpriseunix2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise UNIX
Rule name:F01_s1ckrule
Create hunting rule
Author:s1ckb017
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:MALWARE_Linux_Kinsing
Create hunting rule
Author:ditekSHen
Description:Kinsing RAT payload
Rule name:MAL_ELF_DeimosC2_Beacon_Nov_2022_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect the linux beacon used in the DeimosC2 framework (x64 version)
Reference:https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:setsockopt
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for setsockopt() red flags
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Kinsing

sh ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988

Kinsing

elf 787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2736273/
  
Delivery method
Distributed via web download
  
Dropped by
SHA256 ec1213394717932b0062136ce96d42092e9120da1e32cce7ff355de67c7b6988
  
Dropped by
MD5 e1753baa1b118dc24f6dc0ba82fdafc0

Comments